CVE-2024-56026

CVE-2024-56026 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Greg – SiteOrigin Simple Proxy plugin (simple-proxy) for WordPress. This issue affects all versions of the plugin from n/a through 1.0 inclusive. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and scope change.

Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges, though it necessitates user interaction such as clicking a malicious link. By crafting inputs that are improperly neutralized and reflected in generated web pages, an attacker can execute arbitrary scripts in the victim's browser context, achieving low impacts on confidentiality, integrity, and availability while changing the scope to affect the site's security context.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/simple-proxy/vulnerability/wordpress-simple-proxy-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.